Upwind Expands AI Agent Protection With Context Scanning and Runtime Detection

Discover AnythingSignupWrite New StoryUpwind Expands AI Agent Protection With Context Scanning and Runtime Detectionbyruth_hassonbyruth_hasson|@ruth-hassonA tech newsdesk dispatching breaking software, fintech, AI and innovation updates across global publisher network.SubscribeJuly 30th, 2026TLDR Your browser does not support the audio element.Speed1xVoiceDr. One Ms. Hacker byruth_hasson@ruth-hassonbyruth_hasson|@ruth-hassonA tech newsdesk dispatching breaking software, fintech, AI and innovation updates across global publisher network.Subscribebyruth_hasson|@ruth-hassonA tech newsdesk dispatching breaking software, fintech, AI and innovation updates across global publisher network.Subscribe The security problem posed by AI agents is not really about the models themselves. It is about everything wrapped around them: the skills, the tools, the connections, and the instructions that determine what an agent actually does once it is set loose in a live environment. Upwind Security is tackling that problem directly with two new releases: the AI Agent Context Scanner and the general availability of AI Detection & Response, or AI DR.Why Context Matters More Than the Model AI agents today are functionally different from the applications security teams are used to defending. They call tools. They invoke APIs. They access data stores. They make decisions and execute them using real enterprise credentials, often without a human reviewing each step. And critically, how an agent behaves is shaped by more than its underlying model. It is shaped by a dynamic context assembled in real time from skills, tools, Model Context Protocol connections, memory, and active instructions. Every one of those components is a potential entry point for something dangerous. A skill can carry a specialized prompt with hidden workflow logic. A tool can be misconfigured to allow more access than intended. An MCP connection can pull in external instructions that were never vetted by anyone on the security team. Because each of these can inject content directly into an agent's context window, a single bad instruction has the power to redirect the agent's entire reasoning process and put its permissions to malicious use. The Context Scanner's Approach Upwind's new AI Agent Context Scanner is built specifically to get ahead of that risk. It continuously analyzes the building blocks assembling an agent's operational context: the skills containing prompts and workflow logic, the tools enabling actions like querying databases or running scripts, and the MCP connections funneling in external data, memory, and instructions. The scanner does not limit itself to a single environment. It evaluates these components wherever they actually run, across employee endpoints, cloud infrastructure, and managed AI providers, looking for unsafe or unintended instructions before an attacker or a careless configuration can exploit them. Once findings surface, they are enriched with additional context from the broader Upwind platform. That step matters because it lets security teams prioritize based on real runtime risk instead of chasing down every alert a scanner produces in isolation. What Happens After Deployment: AI DR Scanning context before deployment solves half the problem. The other half is knowing what an agent does once it is running. That is where AI DR comes in, now generally available and extending Upwind's existing runtime intelligence into the world of AI agents specifically. AI DR continuously builds a behavioral baseline for each agent: which tools it typically calls, which APIs and data stores it normally accesses, and what a standard session looks like. When an agent's tool calls, destination endpoints, or overall session behavior start to drift from that baseline, AI DR flags the deviation as it happens, not after the fact. From there, Upwind correlates the flagged activity with a wide set of signals, including workload identity, network topology, API traffic, data